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Abstract 

This paper considers the use of an entanglement breaking channel in the construction 
of a secure bit-commitment protocol. It is shown that this can be done via a depolarizing 
quantum channel. 
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Introduction 

The most successful cheating strategy against non-relativistic bit commitment schemes is 
the entanglement attack (also known as the EPR attack) [8] [2]. In this strategy, one of 
the parties (Alice) entangles a system with the one she uses for commitment and keeps 
this second system secret. Then she is able to cheat before the opening phase through 
local operations on her own system. One approach to counter this cheating strategy is to 
determine a means of breaking the entanglements. This must be done either through local 
transforms performed by the other party (Bob), or through local noise applied to Bob's 
system (from the transmission channel). 

Entanglement breaking channels are a relatively new concept in quantum information 
that were first introduced in [3j. The characteristics of two-qubit entanglements are dis- 
cussed in [4j and [5J. In particular, the local two-qubit entanglement-annihilating channel 
(2-LEA) is examined in ^From [3], a local channel c is called entanglement breaking if 
the output of the channel operating on an entangled state is separable, where separability 
for a density matrix p means p = '^iPip\ ® Pb- next section, we describe through 

an example how an entanglement breaking channel can be used to secure the Bennett and 
Brassard bit commitment scheme [1] against an EPR attack. 

Depolarizing Channel Bit Commitment 

As is typical, we assume Alice is working in a noise free environment, i.e., a perfectly 
shielded and isolated lab. Therefore the joint noise which corrupts the entangled state pab 
is I <S> EcIpab], where £c is the channel noise. This entanglement breaking operation must 
either be applied by Bob through some apparatus he possesses for adding noise, or by the 
quantum channel through which Alice sends the qubits to Bob, as shown in Figure 1. Here 
we use a depolarizing channel to apply the entanglement breaking operation. This channel 
is defined in [5J as 

e{X)=qX + il-q)tr[X]h 
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The action of the depolarizing channel replaces the qubit with the completely mixed state, 
2, with probability 1 — q. 

It was shown in [6] [7] that the evolution of any entangled state in a channel (entanglement 
breaking channel in this case), is determined by the evolution of a maximally entangled state 
in the channel. Therefore we only consider the effect of the entanglement breaking channel 
on the maximally entangled state = -^^HOaOb) + IIaIb))) where the subscripts A and 
B denote Alice and Bob, respectively. It was proven in [7j for a local quantum channel S 
(which operates on a qubit), an entangled state \X) (which is a bipartite N <Si2 state), and 
concurrence C as defined in [7] (a measure of entanglement), that 

C{{I^mX){X\]) = C[\X){X\]]C[{l0§)U+){^+\]]. 

Since C[|X)(X|]] = for \X), which is a separable state, if a local channel S (or I (^S for 
the entire system) applied on the maximally entangled state disentangles it, then we 
have C((/ (gi S)[\X){X\]) = 0, which disentangles any bipartite N 02 state. 

Having a maximally entangled state \ip^) and applying a depolarizing channel on Bob's 
state (which means the effect of the channel on the entire system is {10 e)[X]), results in 
the state 

which has been shown to be separable for q < [4j. Therefore as discussed above, this 
channel will disentangle Bob's qubit from any other system (such as Alice's secret system). 
Now assume the two parties use the simple Bennett and Brassard bit commitment scheme 
in which Alice sends random selections of | t) or | — )•) for 0, and | /^) or | \) for 1. Since 
p+ = = p, if p passes through the channel Bob will expect to receive qp + {1 — q)tr[p] ^I. 
Thus if Alice attempts to cheat (i.e., entangle her secret system with Bob's qubit), he will 
receive a separable state after applying the depolarizing channel {pchannei = J2iPiPa Pb)- 
Therefore the states of Alice will be disentangled from Bob's system, and more importantly 
he can determine if Alice has cheated or not. To show this, two cases must be considered, 
Alice is honest and has not cheated, and Alice attempts to cheat. For the first case, the 
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probability of Bob receiving the same state as Alice sent is q. Therefore the probability 
of Bob measuring the correct state is | since the probability of choosing the correct basis 
is ^. Bob should then expect to measure at least | of the states correctly. In the second 
case, Alice cheats and entangles her secret states with the committed qubits. After Bob 
performs the depolarizing operation, the state will be disentangled as described previously, 
and therefore Alice cannot change the state that Bob measures. There is also no guarantee 
that the probability of Bob measuring the correct state is |, so Alice may be exposed 
regarding the entanglements even if she does not change the committed bit. 

A simple security analysis regarding our example using the Bennet and Brassard scheme 
is given below. Alice prepares an entangled state |ao)yi|0)B + |ai)A|l)_B, where the subscript 
A means the state is controlled by Alice and B controlled by Bob. Alice then sends Bob's 
states to him, and when she wants to change her mind about the committed bit she performs 
a unitary transform followed by a projective measurement on her own state (we can just 
assume a projective measurement). The effect of the entanglement breaking channel on the 
system after Alice's measurement is pb = J2iPi{'^j\Pa\'^j)Pb^ where Uj is the basis for the 
projective measurement. Thus in order for Alice to determine pb she needs to know the 
decomposition caused by the channel, i.e., Pchannei = YliPiP^a ® Pbi therefore she needs 
to know the value of q (which we assume is controlled by Bob). 

Chailloux and Kerenidis [9] provided lower bounds on an optimal quantum bit commit- 
ment (the bounds are tight and the upper bounds are close to the lower bounds), however 
they assumed that the operations in both the commitment and revealing phases are uni- 
tary transforms on Alice and Bob's quantum spaces. Here we take the same approach 
towards analysing the security of our system. For the Hiding property (i.e. the ability of 
Bob to guess the committed bit assuming a honest Alice) , we know that without considering 
the channel Bob can guess the bit with probability ^ + ^^"""'""^^ (where ab is the density 
matrix assigned to or 1). The effect of the channel, Bob's ability to cheat is then simply 
the maximum of his ability to distinguish the states with or without having them passed 
through the quantum channel, which is given by 

PscHeat = \ + Max{^^, 

Where S[.] is the effect of the channel. For Alice's cheating probability, consider the follow- 



ing. 

We assume a cheating Alice prepares a state pab and sends it to Bob so that just be- 
fore AUce opens the bit, the state of that part of the system which Bob possesses is 
(Tb = rryi(a[/ (8) where a[.] is Ahce's operation on her own part of the system (i.e. 

A unitary transform followed by a measurement). Now assuming that S[.] is an entangle- 
ment breaking channel, we have as = YliPi'^''^A{A[pa]) Pb- Assuming Alice wants Bob to 
measure 0, she should maximize the probability of Bob detecting cto, which is F'^{aBend, c^o), 
where F is the fidelity. This means Alice must know the pi and properly choose the value 
of rrA(A[Ptt]) (i.e. she also needs to know the pi). This requires Alice to know the channel 
characteristics, but these are controlled by Bob and is kept secret by him. 

Conclusions 

In this letter we have shown that by using an entanglement breaking channel, the simple 
Bennett and Brassard bit commitment scheme can be made secure against EPR attacks. 
We also presented an example of a depolarizing channel which is practically conceivable. 
Only entanglement attacks were discussed, we leave the unconditional security of these noise 
based systems as a topic for future research. 
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Figure 1: Two possible implementations of the depolarizing channel for bit commitment. 
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